# How does Kerckhoffs's principle apply to Adversarial Neural Cryptography?

Martın Abadi and David G. Andersen recently published a paper on arxiv titled: "LEARNING TO PROTECT COMMUNICATIONS WITH ADVERSARIAL NEURAL CRYPTOGRAPHY" (https://arxiv.org/pdf/1610.06918v1.pdf).

I was wondering why Eve neural network $E$ does not get as input the learned parameters $\theta_A$ and $\theta_B$?

If really $K$ is supposed to be the only value that comprises the symmetric key, then in order to adhere to Kerckhoff's principle, one should view the training output (namely, the final values for $\theta_A$ and $\theta_B$) as public information. So, upon "alternating" the training phase to $E$, I supposed $E$ should receive as input $\theta_A$ and $\theta_B$ as well as $C$.

An alternative view would be that the training phase is regarded as a key generation algorithm. In such a view, the only challenge remaining is to really make training very efficient. But I do not think that this view was the intention of the authors because they explicitly contrasted their work to prior work that aims at generating cryptographic keys.

So my initial question still holds. Why is Kerckhoffs's principle (https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle) apparently totally overlooked in this notion of neural cryptography? What am I getting wrong?

If I'm interpreting section 2.2 correctly, the "optimal Eve" $O_E(\theta_A) = argmin_{\theta_E}(L_E(\theta_A, \theta_E))$ is actually allowed to see Alice's parameters $\theta_A$. The training of Alice and Bob is, in plainer (and rougher!) terms, trying to solve this question: what are the best choices of $\theta_A$ and $\theta_B$ such that if:

1. We reveal $\theta_A$ and $C = A(\theta_A, P, K)$ to Eve but neither $P$ nor $K$;
2. We reveal $\theta_B$, $C$ and $K$ to Bob, but not $P$;

...then Eve's ability to infer information about $P$ is minimized but Bob's is maximized?

So I don't think there's a Kerkhoff's principle problem here. My concern, actually, isn't that Eve knows too little about Alice and Bob, but rather whether Alice and Bob might know too much about their adversary Eve. If we unwind the definition of the "optimal Alice and Bob" $(O_A, O_B) = argmin_{(\theta_A, \theta_B)}(L_{AB}(\theta_A, \theta_B))$ we find that it refers, indirectly through the definition of $L_{AB}$, to the definition of the "optimal Eve" $O_E(\theta_A)$. If we chase this down in turn, we find that this definition indirectly refers to the function $E(\theta_E, C)$—the function that, given a choice of parameters $\theta_E$ for Eve, produces her guess $P_{Eve}$ of the plaintext that corresponds to the ciphertext $C$.

So Alice and Bob are allowed to know what function $E$ is. I think cryptographers would want $E$ to be a universal Turing machine and allow $\theta_E$ to be any polynomial-time program, but it sure sounds like the paper's Eve only considers a subset of that, and that Alice and Bob know which subset that is. So, in simpler language, I fear that Alice and Bob may know too much about "how Eve thinks" (the membership of the narrow set of functions that Eve can compute).

• I am afraid I am a bit confused about considering the input to the loss function $L_E$ as also input to $E$. I agree though about your concern that Alice and Bob seem to know more than necessary by "observing" the evolution of $E$'s behavior. – Akram El-Korashy Oct 30 '16 at 11:16
• I think the common concern is the fact that training of both $E$ and $A$ is done simultaneously. Classically, the encryption algorithm used by $A$, namely $\theta_A$ is assumed to be known beforehand, and available as possibly an embedded subroutine for the adversary $E$ to use. This typically gives an advantage to $E$ which can query an encryption oracle in classical security definitions. I am wondering whether we should think of other formulations of security definitions which characterize the neural network itself, not a fixed encryption scheme (which is the output of the neuralnet). – Akram El-Korashy Oct 30 '16 at 11:28
• @AkramEl-Korashy: I'm not at all confident that I'm understanding the training part correctly, but as I read it, they alternate between training Alice + Bob and training Eve: they first train Eve with the initial random $\theta_A^0$ to get a $\theta_E^0 = O_E(\theta_A^0)$, then train Alice and Bob with $\theta_E^0$ to get $\theta_A^1$, etc.: $\theta_E^i = O_E(theta_A^(i-1))$ and then $\theta_A^i$ is an indirect function of $\theta_E^i$. But in any case, my answer focuses on the definitions of the optimal functions rather than on the procedure to train the networks to approximate them. – Luis Casillas Oct 30 '16 at 20:51
• Actually now I understood your answer. Thanks! What concerns me about this training strategy is that $A$, $B$, and $E$ seem to be modeled as cooperative, while $E$ need not necessarily be so. So I was wondering whether that was related to your concern that "Alice and Bob might know too much about their adversary Eve". – Akram El-Korashy Oct 30 '16 at 22:02
• @AkramEl-Korashy: Well, here we're really getting into analogies and overinterpreting what is ultimately a system of mathematical definitions. You could look at it as Eve being "cooperative" with Alice and Bob, but alternatively we could go with my "Alice and Bob know how Eve thinks" analogy and say that Alice and Bob are able to strongly predict how Eve will attack their cryptosystem. There is no criterion to decide between these. Or perhaps we should say instead that the math could be used to model either scenario. – Luis Casillas Oct 31 '16 at 2:12